Search results

Performance issue at WAF compilation

Status: Open.

#1644 In corazawaf/coraza;

· racheedevel opened on Jul 21, 2026

SQL Injection detection fails for URL-encoded payloads due to missing t:urlDecode transformation in rule 942100

Status: Open.

#1643 In corazawaf/coraza;

· vagrantsd opened on Jul 21, 2026

Large octet-stream request bodies are force-parsed into REQUEST_BODY/ARGS and transformed → memory blow-up (SecRequestBodyNoFilesLimit not enforced; forced URLENCODED vs RAW)

Status: Open.

#1628 In corazawaf/coraza;

· jptosso opened on Jun 8, 2026

_abck cookie not indexed in REQUEST_COOKIES_NAMES when value contains ~ and /

Status: Open.

#1620 In corazawaf/coraza;

· ZeJ0hn opened on May 18, 2026

Coraza no longer 'best effort' parses JSON messages larger than configured SecRequestBodyLimit

Status: Open.

#1611 In corazawaf/coraza;

· Kortekaasy opened on Apr 16, 2026

feat: depth-first evaluation for chained SecRule directives

enhancementNew feature or requestNew feature or request

Status: Open.

#1608 In corazawaf/coraza;

· fzipi opened on Apr 7, 2026

feat: encrypted audit log fields for sensitive phases

enhancementNew feature or requestNew feature or request

Status: Open.

#1607 In corazawaf/coraza;

· fzipi opened on Apr 7, 2026

Add support for short syntax on pm operator.

Status: Open.

#1600 In corazawaf/coraza;

· fzipi opened on Apr 5, 2026

Hardcode version number in constant for each tag

Status: Open.

#1590 In corazawaf/coraza;

· jptosso opened on Apr 2, 2026

Include Owasp CRS by default

Status: Open.

#1581 In corazawaf/coraza;

· jptosso opened on Mar 31, 2026

Add code blocks to documentation

Status: Open.

#1575 In corazawaf/coraza;

· fzipi opened on Mar 28, 2026

docs: investigate RESPONSE_CONTENT_LENGTH variable

documentationImprovements or additions to documentationImprovements or additions to documentation

good first issueGood for newcomersGood for newcomers

Status: Open.

#1566 In corazawaf/coraza;

· M4tteoP opened on Mar 22, 2026